A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems.

DoubleCup · Song · 2017

Introduction: A Dangerous Evolution in Modern Cybercrime Cybercriminal operations continue to evolve at an alarming pace, combining social engineering with advanced malware delivery techniques that make traditional security defenses increasingly ineffective. Security researchers have now uncovered DOUBLECUP, a sophisticated Russian Loader-as-a-Service (LaaS) platform that demonstrates how professional cybercriminal groups are transforming malware distribution into a commercial ecosystem. Unlike conventional malware loaders, DOUBLECUP introduces multiple layers of stealth by hiding malicious code inside seemingly harmless PNG images, leveraging browser caches as temporary storage, and encrypting payloads using victim-specific cryptographic keys.

A SOCRadar Threat Research Unit report published on 3 August 2026 detailed DOUBLECUP, a Russian Loader-as-a-Service designed to support ClickFix campaigns.

A New Wave of Cyber Threats Is Turning Familiar Tools Into Weapons Cybersecurity rarely announces its next major threat with a dramatic warning. More often, the danger arrives quietly: a fake login page, an ordinary-looking image, a browser cache file, or a management server that appears to be functioning normally. The latest reports surrounding DOUBLECUP and the actively exploited CVE-2026-18577 demonstrate exactly how quickly attackers are turning everyday technologies into stepping stones for deeper compromise.

The DOUBLECUP loader promises advanced steganography but hides PowerShell code in plaintext after the PNG file. Extractable with FINDSTR, detectable with basic integrity checks.

New malware that uses steganography always gets my attention, but I was disappointed when I looked at the latest DOUBLECUP write-up. It doesn&#;x26;#;39;t use real steganography:

At a Glance

Read more

A new Loader-as-a-Service called DOUBLECUP uses steganography to hide malware like CountLoader and DeviceManager RAT inside PNG images stored in browser...

A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. [...]

DOUBLECUP, a Russian loader service, stages malware in the browser cache via ClickFix, then rebuilds it with trusted tools to drop a RAT on Windows and macOS.